Coordinated Bot Attacks Target Serbian Student Activists and Macedonian Independent Media

Widespread Digital Assault on Activists and Journalists

In a series of coordinated digital attacks throughout November 2025, Instagram profiles belonging to the Serbian student movement 'Students in Blockade' and the North Macedonian independent media outlet Sloboden Pechat were targeted. These sophisticated operations aimed to disrupt their online presence, primarily by triggering automated platform responses designed to shut down or limit the visibility of their accounts.

Serbian Student Movement Under Siege

The 'Students in Blockade' movement, which emerged from widespread protests against government corruption following a railway station canopy collapse in Novi Sad in November 2024, relies heavily on social media for communication and mobilization. Their main Instagram profile, boasting over 1 million followers, along with accounts of individual faculties such as the Faculty of Technical Sciences (FTN) and the Faculty of Dramatic Arts (FDU), experienced two primary forms of attack.

• A sudden and massive influx of fake, foreign followers.
• Mass reports for inappropriate content.

Both tactics were designed to exploit Meta's algorithms, leading to automatic profile suspensions or deactivations. Balša Bulatović, a student from the Faculty of Technical Sciences, explained that the goal was to 'silence the students' voice' by disabling their primary communication channels. The student movement's IT support unit, IT Blokada, issued warnings and, through quick action, largely prevented lasting damage, though some TikTok accounts were temporarily deactivated.

Macedonian Media Outlet Faces 'Shadow Ban' Attempts

Almost simultaneously, Sloboden Pechat, a prominent North Macedonian independent media organization with nearly 70,000 Instagram followers, became the target of similar bot attacks. The attacks, which began around November 6, 2025, involved:

• Flooding the profile with hundreds of identical bot comments, often containing only the word 'like'.
• A massive and unexpected surge in bot-generated likes.

The editorial team at Sloboden Pechat described the attack as 'extremely sophisticated, not simple at all, involving multiple layers, and evolving over time'. Their intention, as reported by Meta.mk, was to trigger a 'shadow ban', making the profile less visible to its audience without an official block. In response, Sloboden Pechat locked its Instagram profile to mitigate further bot activity and engaged its audience to counter the effects of the shadow ban.

Implications for Digital Civic Space

These parallel attacks highlight a growing vulnerability for civic actors and independent media relying on commercial social media platforms. Experts, including Professor Djordje Krivokapic of the SHARE Foundation, noted that such coordinated operations require significant resources and organization, suggesting a high motivation behind the perpetrators, though their identity remains unverified. The incidents demonstrate how platform algorithms, designed to detect inauthentic behavior, can be weaponized to silence critical voices and restrict public communication in the Western Balkans.